mirror of
https://github.com/Stirling-Tools/Stirling-PDF.git
synced 2026-09-02 21:03:34 +03:00
James Brunton
eb08e60d67
# Description of Changes The `pre-commit` commands in this repo are inconsistent with the rest of the dev workflow, as they are impossible to run through Task and they can cause CI to fail with no way for a developer to run the `pre-commit` scripts after they've failed. This PR adds `task pre-commit` (and `task pre-commit:fix`) and then hooks up the existing `pre-commit` hooks and CI to call the Task rule, so if developers are using pre-commit hooks then they should still work, but they're also runnable without using pre-commit at all. I think it'd be worth reviewing what we're actually running at pre-commit in the future because I'm not entirely convinced by all of the scripts that we are running, but this should at least make what we have properly enforced and usable by all devs.
31 lines
756 B
Bash
31 lines
756 B
Bash
#!/usr/bin/env bash
|
|
# Download, checksum-verify and extract the gitleaks binary.
|
|
#
|
|
# Usage: install-gitleaks.sh <url> <sha256> <dest>
|
|
#
|
|
# Called by the pre-commit:gitleaks-bin Task target, which owns the pinned
|
|
# version and per-platform checksums and passes the resolved values in.
|
|
set -euo pipefail
|
|
|
|
url=$1
|
|
sha=$2
|
|
dest=$3
|
|
|
|
if [ -z "$sha" ]; then
|
|
echo "No pinned gitleaks checksum for this platform" >&2
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p "$(dirname "$dest")"
|
|
archive=$(mktemp)
|
|
trap 'rm -f "$archive"' EXIT
|
|
|
|
curl -fsSL "$url" -o "$archive"
|
|
actual=$(shasum -a 256 "$archive" | awk '{print $1}')
|
|
if [ "$actual" != "$sha" ]; then
|
|
echo "gitleaks checksum mismatch: expected $sha, got $actual" >&2
|
|
exit 1
|
|
fi
|
|
tar -xzO -f "$archive" gitleaks > "$dest"
|
|
chmod +x "$dest"
|